Skip to content
Run402 Docs

GitHub Actions deployments

Use the CLI to create the binding and workflow for an existing intended project:

Terminal window
run402 ci link github --project prj_example --repo owner/repository --branch main
run402 ci list --project prj_example

Inspect the generated workflow before committing it. The binding constrains repository/ref and allowed deployment authority; route declarations need their own allowed scope. Avoid broadening scopes merely to make a failed job pass.

The workflow exchanges GitHub OIDC with id-token: write; it does not require copying a local allowance file or service key into GitHub secrets. Keep destination selectors consistent. The CI reference describes environment bindings, expiry and revocation.

Run the application’s build and relevant checks before deployment. Preserve deployment/verification output as sanitized evidence; do not report a successful build as a deployed app. CLI remains suitable for CI even though the SDK is available for richer programmatic composition.

Read the result and recover

Section titled “Read the result and recover”

Confirm ci list contains the binding for the intended repository/ref. A job rejected during OIDC exchange has not proven deployment authority: check the repository, ref, environment and id-token: write against the binding. Correct those inputs before granting broader scopes. If activation succeeds but verification is pending, rerun verification using the deployment’s project and release evidence.